Privacy Policy

Mashdun LLC is a software and AI studio based in Tennessee, United States. For any question about this policy, or to exercise any right described in it, contact matt@mashdun.com.

[For counsel: insert registered business address and, if a data protection representative is appointed, their details.]

We collect different information depending on how you interact with us.

If you contact us or browse the site.

• Your name, email address, company, and anything you write in the message.
• Server logs kept by our hosting provider, which include IP address, browser type and the pages requested. These are used to keep the service running and secure.

If we send you a proposal.

• Your name, title, email address and company.
• A record of acceptance: the name and title you type, the date and time, and the IP address the acceptance came from. This exists because acceptance forms a contract and we need to be able to evidence it.

If you complete a client onboarding form. This is the most detailed information we hold, and we collect it only from customers who have engaged us:

• Business identity: legal name, trading name, entity type, industry, website, year founded, size, and registered address.
• Your Employer Identification Number (EIN), where you provide one. We ask for it because payment processors and mobile carriers require it to register accounts and messaging campaigns in your name. We do not ask for, and ask you not to provide, a Social Security Number.
• Contact details for the people we will work with — primary, billing and technical contacts.
• Information about your existing systems: payment processor and volumes, messaging provider and use cases, domain registrar, DNS, hosting, email provider, and the tools you use.
• Brand materials you upload or link to, including logos.
• Project information: goals, deadlines, who approves work, and any compliance requirements you tell us about.

If you pay us. Payments are processed by Stripe. We receive confirmation of the amount, the status, and an identifier for the transaction. We never receive or store your full card number or bank account credentials — those go directly to Stripe.

If you take part in a scoping call. Where we use a voice assistant to scope a project, the conversation is transcribed and the transcript is used to draft the proposal. See AI and automated processing.

• To provide the services you asked for — writing and sending proposals, opening projects, raising invoices, and registering the accounts a project needs. This is necessary to perform our contract with you.
• To take payment and keep financial records. Necessary for the contract, and for our legal obligations around tax and accounting.
• To communicate with you about work in progress, including transactional email and, where you have opted in, text messages.
• To keep the service secure and investigate misuse. Our legitimate interest in operating safely.
• To meet legal obligations, including retaining records we are required to keep.

[For counsel: the bases above are framed in GDPR terms. Confirm whether this framing should be kept given the customer base, or replaced with a US-only formulation.]

Where a project involves sending text messages — either to you, or on your behalf to your own customers — the following applies.

• We only message people who have opted in. We do not buy, rent or scrape phone numbers, and we do not send marketing messages to a number that has not consented to receive them.
• Consent is not shared. Mobile information and consent to receive messages are never sold, rented or shared with third parties or affiliates for their own marketing purposes. Phone numbers are shared with our messaging provider only to deliver the messages you asked for.
• You can stop at any time. Reply STOP to any message to be removed, or HELP for assistance. Message and data rates may apply. Message frequency varies.
• Where we operate messaging on your behalf, you remain responsible for the consent you have obtained from your own recipients, and we act on your instructions.

[For counsel: this section is reviewed by mobile carriers during 10DLC campaign registration. The “consent is not shared” sentence in particular is checked against published policy text, and campaigns are rejected where it is missing or qualified. Please confirm wording before launch.]

We use AI tools as part of how we work, and you should know what that means for anything you send us.

• Documents you upload. If you send us a brief, an RFP or a scope document, its text is extracted and sent to a large language model provider so we can draft a proposal from it. Do not upload material you are not free to share with a third-party processor.
• Scoping conversations. Where a call is scoped with our voice assistant, the audio is processed by a speech provider and the transcript is used to produce a draft. The transcript is held with the proposal it belongs to.
• Drafting assistance. Text you dictate or ask us to improve within our tools is sent to a language model to produce the suggestion.
• No decisions are made about you by a machine. Every proposal, price and commitment is written and approved by a person before it reaches you. AI drafts; it does not decide, and it never sets a price.
• We do not permit our providers to train on your content. Our processors are engaged on terms that prohibit using your data to train their models.

[For counsel: current providers are OpenAI (drafting) and ElevenLabs (voice). The training statement must be checked against the plan and terms actually in force with each.]

We do not sell your personal information for money.We do use advertising pixels on our website, and under California law that counts as “sharing” for cross-context behavioural advertising — so we say so plainly, and you can opt out at any time. Those pixels never load unless you allow them.

We share information with the providers we need to run the service:

• Stripe — payments and, where you connect an account, payouts. Stripe is the controller of the card and bank details you give it.
• Resend — sending email on our behalf.
• Supabase and Vercel — database hosting, file storage and application hosting.
• OpenAI and ElevenLabs — as described under AI above.
• SignWell — where a proposal requires an e-signature.
• Our accountant and professional advisers, where needed.
• Google, Meta and LinkedIn — only where you have allowed advertising cookies. See the Cookie Policy.
• Anyone we are legally required to disclose to.

[For counsel: this list should be kept current. It is the list a customer will hold us to.]

• Proposals, onboarding records, invoices and payment records: kept for the duration of the engagement and then for as long as required for tax, accounting and limitation purposes.
• Contact form enquiries that do not become engagements: kept while the enquiry is live and for a reasonable period afterwards.
• Uploaded documents and call transcripts: kept with the proposal they relate to, and removed when it is.
• Server logs: kept for the period our hosting provider retains them.

[For counsel: fixed retention periods should replace these descriptions.]

Whoever you are and wherever you are, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete what we hold, subject to records we are required to keep.
• Stop sending you marketing, at any time.

The quickest route is our data request form, or email matt@mashdun.com. We will respond within 30 days. We will not treat you differently for exercising any of these rights.

If you are in California, you have the rights to know, delete, correct and opt out of sale or sharing under the CCPA as amended. We do not sell personal information for money, but our advertising pixels do constitute “sharing” — use Do Not Sell or Share My Personal Information to opt out. We do not knowingly collect information from anyone under 16.

Our website sets cookies needed to sign you in and keep it working. With your permission it also loads Google Analytics and the Meta and LinkedIn advertising pixels — nothing beyond the strictly necessary loads until you choose. The Cookie Policy lists each one.

Data is held in managed, access-controlled infrastructure, encrypted in transit, with row-level restrictions in the database and administrative access limited to those who need it. Card and bank details never reach our systems. No system is perfectly secure, and we will tell you promptly if something happens that affects you.

Our services are for businesses. We do not knowingly collect information from children.

If we change this policy we will update the date at the top, and tell you directly where the change materially affects an engagement already under way.